Brian Krebs said Rufus left him with about 100 trojans, then wiped the PC that could have proved it

The post went up on the afternoon of October 23: “Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.” Rufus is the little program a lot of people grab to turn an ISO into a bootable stick, and Krebs has the kind of following that turns one post into a warning a lot of people pass along.

The edits started six minutes later. The first said the fault was likely his, because the download came from rufus[.]ie, “which apparently is not the official site.” Four minutes after that, the edit said rufus[.]ie “is apparently the official site,” and that during installation the program “threw up a couple of rather verbose messages saying it needed to download additional components.” In a reply he added: “I’m guessing supply chain hack. i have no data to support that, though.”

A reader, jordinki, ran Rufus through the ANY.RUN sandbox to check. Its report marked Rufus’s own executables as malicious.

Pete Batard, who maintains Rufus, opened issue #3064 on the project’s own tracker that night. His first point was that Rufus “does NOT come with an installer,” so whatever Krebs called installation was probably Rufus copying an image to the stick. The extra downloads Krebs saw are real and announced: the Syslinux and GRUB bootloader files some images need, each behind an explicit prompt. And some images are full of files antivirus software hates. A penetration-testing distro like Kali ships its tools inside, and Defender, as Batard explained, doesn’t dig through the ISO as one file, but it does scan each tool as Rufus extracts it to the stick.

The next morning Batard posted screenshots of Rufus 4.15 writing the Kali 2026.2 installer, prompt by prompt, ending with Defender reporting “a bunch of trojans and stuff,” which he wrote “is expected and comes from the nature of the Kali ISO, not Rufus.” Kali is his example. Krebs has only said it was “the Linux ISO I was trying to burn.”

The sandbox result got its own explanation. A commenter, RipperFox, traced it to an old Rufus routine that turns off autorun through Group Policy and saves the whole policy object when it does, which rewrites the sandbox’s existing Windows Defender policy values under Rufus’s name. Batard thanked him and said the next version drops that Group Policy code and sets the registry key directly.

By then Krebs had changed the post’s edit a fourth time, after what Batard called “a very civil discussion”: the alerts were “almost certainly from Windows Defender scanning the files in the Linux ISO I was trying to burn, and not from the program itself. I’m willing to accept that may be the case here, but I also no longer have a way to check b/c I nuked the system after all the alerts.” In a separate post he wrote, “Windows Defender went bananas,” and “I wish I had a record of it but I nuked everything after the alerts.”

One career malware analyst in the thread put the cost plainly: “If he showed you his Defender logs before nuking his device this would have been 100x easier.” Batard says he isn’t posting a statement on the Rufus site. Krebs also said the PC’s firmware threw a warning when it restarted, and nobody has said what that was.

A post from a name like Krebs’s travels faster than an issue thread does, and Batard said as much: some people “will always run with whatever initial assessment they’ve seen.” Open-source maintainers who ship anything that touches disks, boot loaders or system policy are going to keep getting these, because the tools look exactly like malware to a scanner that’s watching for disk and policy changes. Expect more projects to publish what a normal run looks like to Defender and to sandboxes, so the next scary screenshot has something to be compared against.